I don't understand.
So R4 cards only work for DS games, and suddenly Nintendo has to be worried about them working on the 3DS whose carts are a little different from DS carts? I can't imagine the system being stupid enough to load a 3DS game from a DS cart.
If/when someone gets a 3DS R4 or whatever, it will likely be after the eShop launches since the hackers would also anticipating the firmware, because even if it doesn't have security updates it will make the system function differently, which will affect the hacker's program. Not to mention the time needed to write the program.
I'll try to explain it differently since you don't seem to understand what I'm trying to get at here
(there have been 2 new post since i started typing this).
Everyone wants the 1st FW update since it includes the eShop and Internet browser and stuff
Nintendo wants a public test on current security features to see if they have overlooked anything or to see if it gets circumvented too easily.
Nintendo holds back the 1 update everyone is sure to download and install so that they can include any such updates that may be necessary and be able to likely get the widest %age 3DS' to updates because of the includes bonuses (eShop, etc, etc,)
Now because of this testing in the wild, they know that the R4 cards work from the get-go and that people are using them on their 3DS'.
R4 cards could become a potential future problem on 3DS the same way it was on DS if someone finds an exploit through the R4 to allow for DSi or 3DS games,
So now Nintendo can likely put out a firmware that blocks the use of R4 at all and gets the widest spread of it's installation since the update also includes the eShop, Internet browser and other new stuff that every 3DS owner wants access to.
Not to mention any other tweaks that need to be made that weren't discovered until after the system released.
If they had launched the shop and browser right away, then alot of people might not have opted for the update and instead decide to just keep the systems off-network since they already have internet access and already transfered over all their previous software.
tl;dr - Security updates hidden within the 1st and most anticipated update to the 3DS that is most likely to be downloaded by the entire userbase as soon as available.
And from what I read, it's only a very specific type of flashcard that is able to work, so what I was speculating is probably even more likely that you think. Nintendo probably already blocked the use of every flashcard they had onsite and held back the first update to see which ones they may have missed. Now that they know that so far it's only 1 very specific card with a specific FW installed, they now have 3 months to write the new firmware to block out that one and any others they may have missed or never heard of.
Holding back the 1st FW update could be the 1st test of updating security measures over the network for their new OS.